ISO Stuff: Customer Focus

In this series I will talk about sections of the ISO 9001 standard that I have seen organizations struggle with.

This week's topic. Customer Focus.

Customer Focus is one of those "Mom & Apple Pie" requirements in the ISO 9001 standard. The requirement states "Top management shall ensure that customer requirements are determined and are met with the aim of enhancing customer satisfaction." It was added to the 2000 revision of the standard to increase the emphasis placed on meeting customer needs and improving customer satisfaction. While these have always been interpreted as requirements, they were not previously explicitly stated. There's little action mandated directly by this requirement, but Customer Focus is connected directly to two other clauses of the standard that do require specific action. Customer related processes, which describes our obligations around understanding customer product and service requirements, whether explicitly stated, implied, or assumed; and Monitoring & Measurement of Customer Satisfaction, which, as the title gives away, requires that we determine a method of measuring customer satisfaction with our products and/or services. Take these three requirements together and what we have is a system that says that we must figure out what customers want, whether they tell us directly or not, meet those needs, measure how satisfied they are with our efforts and that Top Management needs to care about all of that and use the information to spread the voice of the customer throughout the company.

Ok, so how do we show that we meet this requirement? This set of requirements mean that we need to get closer to our customers, ask the right questions, listen intently to what they tell us, and what they don't tell us. Bring back that information and spread it around. Communicate it often and widely. The Voice of the Customer (VOC) needs to inform how we produce products and deliver services, how we design new products and services. We need to establish measurements that tell us how we are doing and how satisfied our customers are with our efforts. Probably the easiest and most straightforward way to measure this is some measurement of customer complaints although extrapolating inferences from customer complaints to all customers is fraught with difficulty. First is the fact that most customers who experience an issue don't complain. Those that do complain fit a demographic group that you may not want to assume all customers are in. Measuring complaints is a good first step but a better way would be to measure customer satisfaction. There are a number of ways to do this from home made surveys to passive collection of supplier scorecards that customers may provide. The easiest way to show that we are addressing this requirement is to show improving satisfaction, and evidence of incorporation of information derived from customer feedback into products or services.

ISO Stuff-Internal Audit

In this series I will talk about sections of the ISO 9001 standard that I have seen organizations struggle with. This week is Internal Audit.

Internal Audit is part of those requirements that deal with the need for us to monitor the performance of our Quality Management System. As such, you'll find the requirements for Internal Audit under section 8 of the ISO 9001 standard, where monitoring & measurement requirements are laid out.

The purpose of Internal Audit is to ensure that the QMS conforms to planned requirements and is effectively implemented.



Internal audit has two key interactions with other parts of the ISO 9001 standard, one is Corrective and Preventive Action. Internal audits result in identification of issues that require corrective action. Management for the audited area is responsible for taking action in a timely manner on results of audits. The other key interaction is with Management Review. Internal audit results are a key input to management review activities. Think of Internal Audit as the "Eyes and Ears" of management with regards to the integrity of the Quality Management System; its intended to tell management how things are going and where things need to be improved.

Lets cover the requirements for internal audit in detail. The requirements for internal audit are few but there are some critically important points. Here's the requirements:


Internal Audits should be;

1. Process Based
2. Scheduled and conducted according to the status and importance of the process to the overall Quality Management System (QMS).
3. Conducted by personnel not responsible for the work of the process
4. Acted on my management for the area.

Process based. This is a key requirement because it encompassed a sweeping change in audit philosophy with the 2000 revision to ISO 9001 from a clause based audit approach to a process based approach. The intent is that internal (and external) audit activites should focus on the process(es) being audited and let the auditor determine what clauses of the ISO 9001 standard are in play. This approach makes much more sense from the viewpoint of the way the business operates.

Scheduled & conducted according to the status and importance of the process. This requirement has broad, meaningful implications to audit programs everywhere. No longer are Quality Managers required to audit everything in a yearly cycle, now the Quality Manager can assess the status and importance of a process relative to other processes and decide how often to look at that process. There are many different logical strategies that can be employed to make this assessment using everything from a Failure Modes & Effects Analysis (FMEA) type of approach to a simple assessment of business results through dashboard metrics to enable decision making about what to audit and how often.

Conducted by personnel not responsible for the work of the process being audited. This is simple. Auditors can not audit their own work. It ensures an unbiased assessment of the process.

Acted on by management for the area. We've covered this already above. Internal audits find things that need to be corrected, management that is responsible for the process being audited must act on the finding to correct the issues discovered.
As you can see, the requirements for internal audit are not prescriptive. There is no detailed "how to" in the requirements. This generic approach leave the Quality Manager alot of room to interpret how they chose to address the requirements in a way that is effective to their QMS.

One final point about internal audit. Internal audit is NOT intended to be a "gotcha" process, where we "trick" people into revealing the skeletons in the closet. It is intended to be a unbiased assessment of compliance with the planned activities of the QMS. Auditors should be looking equally for best practices and improved processes as they are for non-compliance with planned requirements.

ISO Stuff: The Audit

I went through my third party ISO 9001 assessment recently. That got me thinking a little bit about the experience. I thought I'd share some of what I've learned over the years about this unique experience. First, some background. There are three "registration" avenues that a company can follow. Those are:

Self-Declaration, 2nd Party Assessment, and 3rd Party Assessment.

The difference between these is dramatic so let me explain a little about each.

Self-Declaration is just what is sounds like. If you believe that you have a good solid Quality Management System that, in your opinion and assessment, meets the intent of the relevant quality standard, you can self-declare that your organization complies with the standard. The benefit of this is mainly cost and effort. No cost associated with hiring a registrar to come in and spend several days assessing your system, and no lost time associated with the aforemetioned audit visit. The drawback of this approach is that no one will believe the declaration. It's akin to the "fox watching the henhouse" euphemism.

Second Part assessment is assessment by a customer. The benefits of this approach are similar to Self-Declaration above. No cost. However there is the time component that is in play. You will have to spend time preparing and conducting the assessment. The downsides of this approach are many. Starting with the portability issue. If one customer assesses you, will other customers accept the results or will you find several other customers at your door wanting to conduct an assessment visit also? Additional negatives of this approach are that you won't want to reveal anything except the best parts of your QMS to any customer, for fear of a negative impact to purchasing decisions. This inhibits improvement of the QMS.

Third Party registration is by far the most common approach around the world. There are several reasons why third party is the preferred approach. Third party registrars are independent and accreditted by an international body that ensures their competence, thoroughness, and impartiality. Third party registrations are pretty much universally accepted by any customer. Third party registrars have a unique relationship that presents either a downside or an opportunity, depending on the maturity of the QMS, the attitude of management towards the QMS and the confidence of the Quality Manager. Let me explore this area in more detail.

The relationship with the registrar is a strange symbiotic relationship. The registering company is hired by the company seeking registration, which from a buiness standpoint creates a desire to continue the business. Afterall, we are all in business to make money, even registrars. So the registrar must walk a fine line between "finding" too many things that might harm the relationship and letting the QMS off too easy. This is a big challenge for auditors, again, depending on the maturity of the organization being auditted. Third party registrars are prohibited from "consulting" as this is a conflict of interest that undermines their impartiality. Individual auditors can and do, share information on a one on one basis about potential improvement opportunities that they observe but may not include in their report.

Lets spend a few minutes on maturity. What I mean by this is that different organizations are motivated by different things to achieve registration. Many are interested in getting the certificate on the wall to satisfy a customer demand. Once this demand is met, some organizations stop there and really don't mature much more. On the other hand, some companies enter into the registered quality management system with the motivation of improving their business or perhaps start from a demand from customers and mature into a more enlightened attitude about the value of their QMS. Those with a mature approach to their QMS registrar relationship understand that the registrar works for them and that the third party audit is a tool in their toolbox to help drive improvement in the QMS. The Quality Manager is the key player in making this happen by sharing information with the registrar about weaknesses in the system. Through enabling the third party auditor, the Quality Manager can leverage findings from them to force improvement in areas that may have been resistant to participating.

Third party registration is by far the most common approach used. Customers and competitors universally recognize an independent registrars findings. Due to the business relationship that exists, registrars are interested in adding value for the registered company by helping them mature and improve the QMS beyond just getting a certificate hanging on the wall.

It's the Improvement, Stupid

Apologies if the title offends. I'm borrowing a phrase from a presidential campaign in the 90's to help make my point. In this presidential campaign, the usual back and forth between candidates occurred but the phrase "It's the Economy, Stupid" summed up the disconnect between the candidates and effectively showed how one candidate (my guy, unfortunately) was not connected to the real issues that people were struggling with. This phrase was pretty effective, my guy lost the election. We then spent the next 8 years trying to define what "it" is but that's a post for another time.

So, why do I recall this story? It relates quite well I think to the attitudes that many companies out there have about continuous improvement programs. In the late 80's and early 90's much noise was made about how Baldrige winners were outperforming the stock market. It seemed that Baldrige may have been the secret sauce behind those successes, or at least that was the story. The other side of that picture though was that some of those companies subsequently failed miserably or at least suffered significant downturns in performance, such as ST Microelectronics, Dana Corp, IBM, Xerox, and Motorola. In each of those cases it could be argued that other factors led to the declines seen, and I believe that is true. Winning the Baldrige award does not lead to failure directly. The point in highlighting that some award winners fail is this, winning the award is not the point of the exercise. Certainly it is nice to receive the recognition for a job well done, but the point of having criteria like Baldrige and other similar types of standards is the improvement that comes from applying a consistent standard and measuring performance against that standard. The point of the exercise is the process of improvement that an organization undertakes towards the award criteria, not the award itself. Many companies that have won these types of awards subsequently take their eye off the ball and lose focus, lose their connetion with their customers, lose the drive to improve, become complacent or even arrogant in thinking that they have arrived because they won an award. As Dr. Deming said, "It is not necessary to change, survival is not mandatory". Dr. Deming's meaning here is that change is a constant, competition drives change and those who chose not to continually improve will not survive.

So to paraphrase the political quote from the 1992 presidential campaign, It's the Improvement, Stupid.

ISO Stuff: Competence, Awareness, and Training

In this series I will talk about sections of the ISO 9001 standard that I have seen organizations struggle with. Starting with Competence, Awareness, and Training.

The requirements for Competence, Awareness, and Training are few but very important to success of an organization. The requirements tell us that;
1. People should be competent to perform the work they are doing through a combination of three avenues:
    a. Education
    b. Experience
    c. Training
2. That the organization is responsible to determine competency requirements for satisfactory job performance.
3. That the organization is responsible to provide training or other experiences required to close the gap between the individuals ability and the needs of the position.
4. That the organization must assess the effectivness of training or other experiences provided.
5. That records must be kept of these activities.

Seems pretty straightforward. Determine what skills people need to do the job, assess their education, training, and experience against those requirements, provide training to close any gaps, assess the effectiveness of that training, and record it all. Since its so straightforward, you would think that the programs for addressing  these requirements would also be straightforward. My experience is the opposite in most cases. One typical approach is to assign too much weight to the prior skills and experiences of potential new employees and do nothing to teach them how the do the work that is specific to the company. This is the "we hire PhD's so we don't have to train them" approach. While it is certainly valid to assign some credibility to outside education and prior experiences and skills, this approach ignores the reality that every organization is different. We may hire PhD's but they don't come in the door knowing how its done in our organization. We owe them some level of "indoctrination" to how we expect them to research or perform other duties at our organization. Same is true of managers or technicians. Hiring a manager who has previous experience as a manager is a great starting point, but there are as many ways to manage as there are companies out there. Requirement three above tells us that we owe them some training on how to be successful. According to JDA Professional Services information, the cost to fill a $60,000 per year position can be over four times that amount. Given the high cost of hiring, we should consider it an investment in a successful hire to provide them with the best opportunity to be successful and to check how well they are doing in the roles assigned (requirement 4). The alternative is that we may have to repeat the hire if the employee is not successful, in addition to the suffering the impact on quality of that employee's poor performance.

Why embark on a journey to ISO registration?

This is a subject that is near and dear to my heart. In my twelve plus years of experience as a Quality professional, this is the question I have run up against most. Of course the answers range widely from, "because our customers demand it" to "we think it will help us be a better company". Actually, truth be told that last reason I don't hear as often as I'd like and the first, I hear way too much.

To the purist, the only reason to embark on a journey to ISO registration is to improve the operation of your business. Unfortunately, most purists also get offended at the notion that the deployment should return on the investment in a very real way. The purist believes in Quality for Quality's sake. Being that I am somewhat a purist (reformed slightly) I am a strong believer in the instrinsic value of Quality. I do recognize that companies are not in business for altrusitic reasons, but rather, to make a profit and the notion that a Quality Management System should contribute to that profitability is an altogether reasonable expectation.

The challenge is that Quality Management Systems, as they are typically deployed, are bureaucratic and cumbersome. Ultimately they do not contribute to helping people do their jobs better or easier. Deployment leaders can improve their credibility by keeping some concepts in mind as they progress. First, keep it simple. The base ISO 9001 standard only requires six written procedures, SIX! My experience is that every place I've ever reviewed has had much more than six procedures. So where did all those extra procedures come from? The easy answer is that they come from a misconception based on a simple idea that underlies all registered quality systems, "say what you do, and do what you say". From this simple idea comes the incorrect notion that everything said must be documented. I suggest an easy exercise to decide if a process needs to be documented; look at how its performing. Are there frequent defects, is the process complex and difficult to execute, is the process done infrequently, do people tend to make mistakes while doing it? If any of those conditions exist, then consider a documented procedure. If the process is working well as it is and no requirement exists to document it, don't. The idea is that the QMS should support the business, not add a burden to it. The second principle to keep in mind is to find opportunities to tie the QMS to key business results. This concept is key to getting managements' attention. The key business objectives should be clear to everyone in the organization. What can the QMS help improve upon? Can internal audit reveal anything about why key objectives are not being realized? Could a structured problem solving approach solve key customer problems? If the deployment leader can find real results to tie the QMS to, they will have a much easier time getting management onboard with the system.

The key ideas ingrained in the ISO standards are things that we all can agree are good to do. We should all periodically review the performance of the business (Management Review) using data (Analysis of Data), impartial observers should periodically check to make sure we are doing things right (Internal Audit), whenever we have a problem we should fix it (Corrective Action) and try to prevent it from happening again (Preventive Action), and that people should be skilled at the jobs they do (Competence, Awareness, and Training) among other things. So while embarking on a journey to ISO registration can be successful if motiviated by almost any reason, it will ultimately not be a part of the fabric of the business, unless it supports the needs of the business rather than adding unnecessary burden to it. The ISO standards are truely intended to be a template for how to run a successful business, if only they are used that way.

Good News!

Good news! American Society for Quality has accepted my article abstract for my best practice article "Internal Quality Audits for Impact". Look for it in Quality Progress in the coming months. When I know specifically which issue it will be in, I'll let you know.